160349 matches found
PT-2026-54022
Capgo console.capgo.app/login before 12.128.2 accepts access token and refresh token in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and log...
CVE-2026-58375: Missing Authentication for Critical Function
JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id...
AD Shadow Credentials Auto
Runs Certipy shadow auto against an account and surfaces the resulting TGT/NT hash output. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import class ModulePost: info = "name": "AD Shadow Credentials Auto", "description": "Runs...
protection
🛡️ protection Kernel-level abuse protection for container...
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-2635 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-2635 Source advisory: OSV:PYSEC-2026-421...
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-0545 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-0545 Source advisory: OSV:PYSEC-2026-419...
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2025-15036 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2025-15036 Source advisory: OSV:PYSEC-2026-425...
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-0596 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-0596 Source advisory: OSV:PYSEC-2026-424...
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2025-15379 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2025-15379 Source advisory: OSV:PYSEC-2026-423...
auto-augment (1.0.0), bio-pyminer (>=0.9.13, <=0.10.0) +3 more potentially affected by CVE-2023-48022 via ray (0.8.4)
ray PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - auto-augment 1.0.0 - bio-pyminer =0.9.13, =0.0.0, =0.4.7, =0.4.9 Source cves: CVE-2023-48022 Source advisory: OSV:PYSEC-2026-517...
auto-augment (1.0.0), bio-pyminer (>=0.9.13, <=0.10.0) +3 more potentially affected by CVE-2023-6020 via ray (0.8.4)
ray PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - auto-augment 1.0.0 - bio-pyminer =0.9.13, =0.0.0, =0.4.7, =0.4.9 Source cves: CVE-2023-6020 Source advisory: OSV:PYSEC-2026-516...
auto-augment (1.0.0), bio-pyminer (>=0.9.13, <=0.10.0) +3 more potentially affected by CVE-2023-6019 via ray (0.8.4)
ray PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - auto-augment 1.0.0 - bio-pyminer =0.9.13, =0.0.0, =0.4.7, =0.4.9 Source cves: CVE-2023-6019 Source advisory: OSV:PYSEC-2026-519...
auto-augment (1.0.0), bio-pyminer (>=0.9.13, <=0.10.0) +3 more potentially affected by CVE-2025-34351 via ray (0.8.4)
ray PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - auto-augment 1.0.0 - bio-pyminer =0.9.13, =0.0.0, =0.4.7, =0.4.9 Source cves: CVE-2025-34351 Source advisory: OSV:PYSEC-2026-518...
CVE-2026-49991
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...
CVE-2026-49991
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...
EUVD-2026-39865
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...
CVE-2026-49991 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...
CVE-2026-49991 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...
PT-2026-52909
Name of the Vulnerable Software and Affected Versions RustFS version 1.0.0-beta.4 Description Authenticated users with PutObject permission on their own bucket can exploit a path traversal issue in the Snowball auto-extract feature to write arbitrary objects into buckets belonging to other users,...
📄 Yeoman Environment 6.0.0 Code Execution
Yeoman Environment versions 2.9.0 through 6.0.0 have an issue where missing generators can be installed without user confirmation, turning attacker-controlled project metadata into a package-install and code-execution path. CVE-2026-42089 A local package installation helper trusted caller-supplie...